Questions tagged [tor]

Tor (short for The onion router) is a system intended to enable online anonymity. Tor client software routes Internet traffic through a worldwide volunteer network of servers in order to conceal a user's location or usage from anyone conducting network surveillance or traffic analysis. For non-security questions about Tor, see our sister site Tor Stack Exchange.

Filter by
Sorted by
Tagged with
123 votes
5 answers
28k views

How much can I trust Tor?

How much can I depend on Tor for anonymity? Is it completely secure? My usage is limited to accessing Twitter and Wordpress. I am a political activist from India and I do not enjoy the freedom of ...
Freedom's user avatar
  • 1,265
117 votes
4 answers
22k views

How would a resourceful government block Tor?

I came across this article saying that after the November 2015 Paris attacks, some French police officers proposed to ban Tor. Tor is used to circumvent censorship! What security techniques would ...
user93895's user avatar
  • 1,133
84 votes
2 answers
41k views

Best practices for Tor use, in light of released NSA slides

It has been known in the security community that a tool as versatile as Tor is likely the target of intense interest from intelligence agencies. While the FBI has admitted responsibility for a Tor ...
nitrl's user avatar
  • 3,003
72 votes
4 answers
60k views

How can you be tracked using screen resolution/monitor size in Tor?

Whenever I maximize the Tor browser, it shows a warning: Maximizing Tor Browser can allow websites to determine you monitor size, which can be used to track you... How can screen resolution or ...
Anurag's user avatar
  • 907
71 votes
1 answer
6k views

Tell browser my site has no scripts

I have created a Tor hidden service site which has absolutely no JavaScript or other types of client side scripts. The page is HTML, CSS, images, and some JSP for handling user input. I encourage ...
k1308517's user avatar
  • 1,272
71 votes
6 answers
60k views

Differences between using Tor browser and VPN

I can't quite figure out the differences between using the Tor browser and using a VPN (like concretely proXPN). From what I understand the idea is the same, that they both hide the IP address. The ...
Thomas's user avatar
  • 3,861
59 votes
5 answers
90k views

How do you get a specific .onion address for your hidden service?

.onion addresses normally should be made of a base32 string of the first 80 bits of the SHA1 hash of the private key of the server (see .onion address specification). Today I ran into a service which ...
user avatar
47 votes
7 answers
7k views

How does Tor protect against an attacker just running thousands of nodes?

Does Tor have any protection against an adversary simply running a very large number of nodes? Someone with the necessary resources could just run thousands of relay nodes (including exit nodes). If ...
jdm's user avatar
  • 941
43 votes
3 answers
29k views

How does check.torproject.org know if you're using Tor?

I'm looking at the results from the following URL and would like to know how does the Tor Project website "know" that Tor is being used or not. https://check.torproject.org/?lang=en-US&small=1&...
makerofthings7's user avatar
41 votes
3 answers
8k views

Can anti-virus/virus protection be used to spy on you? [closed]

I'm a complete noob when it comes to these subjects. But here goes... Let's say someone is using a VPN, TOR, or some other tool to enhance their privacy. As I understand it, you are discouraged from ...
Lancadin's user avatar
  • 509
41 votes
2 answers
9k views

Why hasn't anyone taken over Tor yet?

Tor is known to encrypt the transferred content and the meta information by layering the encryption. I know there have been correlation attacks that deanonymized some users by federal agencies. Why ...
N. Nowak's user avatar
  • 585
37 votes
8 answers
23k views

If I visit a HTTPS website when using Tor, is my IP exposed?

HTTPS is an end-to-end encrypted connection. Given this, does the website I am visiting know my original IP? The website is only available over HTTPS (not unencrypted HTTP).
gasko peter's user avatar
35 votes
6 answers
23k views

How to detect if employees are using Tor?

We work in an organisation which is supposed to be HIPAA compliant. Security is a big concern for us. We've been tasked to find out if any user is using anonymous proxy in the network. Is there a way ...
Zameer Ansari's user avatar
34 votes
3 answers
12k views

Why can a Tor exit node decrypt data, but not the entry node?

Me -> Node A -> Node B -> Node C -> destination The documentation on Tor always states that only the exit node C can see plain text data. How is this possible without me talking to Node C ...
Petey B's user avatar
  • 607
33 votes
1 answer
22k views

Why is Home --> VPN --> Tor worse than Home --> Tor?

I've read lot of questions asked on various websites about the pros & cons of using a VPN with Tor. As said on Tails website VPN make the situation worse by introducing a permanent entry guard or ...
Lich4r's user avatar
  • 650
28 votes
4 answers
2k views

Can anonymizing techniques make you less anonymous?

There's a recent report in the news of a Harvard student who emailed in a bomb threat so as to postpone year-end exams. According to the report, he carefully covered his tracks using the best ...
tylerl's user avatar
  • 83.3k
25 votes
3 answers
63k views

Can my workplace view my Tor traffic?

I connect to the internet using my company's Wi-Fi and Tor. Can they still see the websites I visit?
user3877799's user avatar
24 votes
6 answers
20k views

Why is Tor safer than a proxy?

If I use a Tor router to browse the regular internet, my traffic must leave the Tor network through an exit node. Apparently the exit node can see the data originally sent. Is this true? If an ...
TestinginProd's user avatar
24 votes
2 answers
8k views

In the SilkRoad takedown, what does it mean "An IP address was leaking" in Tor?

According to the official complaint, on Page 28 they mention: on May 24, 2013, a Silk Road user sent him a private message warning him that "some sort of external IP address" was "leaking" from the ...
makerofthings7's user avatar
19 votes
3 answers
25k views

How did the FBI compromise Tor users? [closed]

I read in this article that the FBI was able to crack the anonymity of Tor. From what I heard and read, onion routing makes it almost impossible to de-anonymize a user. The last time I heard anyone ...
Andy K's user avatar
  • 411
19 votes
5 answers
40k views

Tor and regular browser side by side. Does that make sense?

Can I use a Tor browser session and a regular Firefox session side by side without corrupting the security of the Tor session? E.g. when I download a new Eclipse version or when I'm searching for ...
Andreas's user avatar
  • 293
19 votes
1 answer
3k views

Could someone explain parts of the FBI's Firefox 0-day?

Here is the full Javascript (and related iframes) that the FBI apparently injected into all "Freedom Hosting" pages in the course of their recent takedown. http://pastebin.mozilla.org/2776374 The ...
Anorov's user avatar
  • 664
18 votes
5 answers
3k views

Stop large requests to my server (TOR)

I am being attacked right now from Tor nodes which are doing 404 requests to my HTTP server. It is from one IP but when i use the DROP iptables rule, it starts again from another IP in a matter of ...
Alex's user avatar
  • 181
18 votes
4 answers
5k views

Does Tor Hidden Service Protocol provide more threat protection than a standard HTTPS session?

DuckDuckGo is a search engine that has a Tor Exit Enclave and hidden service. This site is focused on the safe, secure searching of its users. Since DNS is not used in Tor, it appears that HTTPS is ...
makerofthings7's user avatar
18 votes
1 answer
20k views

What is this potential identity leak that NoScript warns about?

Recently, while using the Tor Browser, NoScript popped up the following warning when I opened a stack overflow link in a new tab from duckduckgo: Potential Identity Leak You are about to load a page ...
nobody's user avatar
  • 11.5k
17 votes
3 answers
17k views

How safe is Tor from MITM/snooping attacks?

I am behind an HTTP proxy, and I frequently tunnel out via an ssh -D SOCKS proxy (I have access to a couple of outside servers which I can tunnel to) when the HTTP proxy causes problems1. Now, this ...
Manishearth's user avatar
  • 8,267
17 votes
2 answers
6k views

Is Tor over VPN a security risk?

In his talk about OPSEC, The Grugq stresses that you first have to go through TOR before connecting to a VPN. Otherwise, the VPN would be a direct link from the endpoint to you. He summarizes: TOR ...
Arbuiwer's user avatar
  • 171
16 votes
1 answer
5k views

How are tor hidden nodes/services found?

Tor has "hidden services", which have an address like duskgytldkxiuqc6.onion. Now I was wondering: how is this duskgytldkxiuqc6.onion name mapped to the real server? I don't think there's a central ...
Folkert van Heusden's user avatar
15 votes
3 answers
9k views

Why is Tor over HTTPS insecure?

I don't get how a HTTPS connection over Tor can be insecure. Where's the difference between a normal HTTPS connection and a Tor -> HTTP connection? Many sites recommend to use the Onion-URL instead of ...
Peter Zwegat's user avatar
15 votes
3 answers
5k views

Is the fact that Tor's development is largely government funded cause for concern?

In light of recent events, I've been learning more about Tor, and I have a lot of questions. Here's one. Wikipedia's article states; As of 2012, 80% of the Tor Project's $2M annual budget comes ...
Garrett Albright's user avatar
15 votes
2 answers
6k views

Does Tor help us to prevent ISP tracking?

If Tor is able to hide the IP address of the machine and make us anonymous, then does it prevent the ISP from tracking us?
Sivaram Rasathurai's user avatar
14 votes
3 answers
9k views

How does the hacker manage to spoof a different IP address?

For the last 2 days, +/- every 15 minutes, someone is attempting to sign-in to my online email account. When I verify recent activity, the IP address (and the corresponding country) is different for ...
robor's user avatar
  • 251
14 votes
3 answers
45k views

Is it safe to access HTTP sites from Tor?

Somewhere I read that you should only open HTTPS links on Tor because otherwise your ISP for example could read the webpages you visit. I searched on the subject and somewhere else I read that the ...
FISOCPP's user avatar
  • 279
14 votes
3 answers
70k views

Downloading files using Tor

I have the Tor Browser Bundle installed and have been using the Firefox Tor browser. If I attempt to download a file or email attachment I get the following warning I understand that if I download an ...
user avatar
14 votes
4 answers
18k views

Detecting Tor proxy by reading request headers

I am a newbie to the field of security. As I was trying to explore more about HTTP request and response headers, I came across this website which provides a detailed analysis of the request header ...
Rahil Arora's user avatar
  • 4,357
14 votes
2 answers
5k views

How does Tor protect against fake entry nodes / total redirection?

There is much material on how to protect yourself from malicious exit nodes, especially by using SSL and minimizing the leakage of identifying information (user-agent, screen size, etc.). However, I ...
jdm's user avatar
  • 941
13 votes
3 answers
2k views

Is there any difference between visiting Facebook via their Tor address, and visiting them via their normal address over Tor?

From a security perspective, is visiting via the .onion address more/less secure? I'm using Facebook as an example, but this question is really about any website which has both a 'normal' and a Tor ...
JMK's user avatar
  • 2,496
13 votes
2 answers
9k views

Why is it so hard to close onion domains (e.g. The Silkroad)?

A few months ago when I started to experiment with bitcoin I came across The Silkroad (only accessible via Tor) For those who do not know what Tor is and who do not want to waste their time ...
Salvador Dali's user avatar
13 votes
2 answers
25k views

Is using VPN, Tor and ProxyChains together more secure?

Similar question (Tor and VPN only). All these three technologies seem to share the same goal, i.e. making internet traffic anonymous. Does it make any sense to try to use them together to increase ...
Edgar Derby's user avatar
13 votes
1 answer
4k views

Is TLS in Tor useless?

I am trying to optimize the Orchid Tor client library for my needs and noticed that every connection with every node uses TLS with turned off certificate verification. Actually there are no TLS ...
ex3ndr's user avatar
  • 131
12 votes
8 answers
13k views

How anonymous is my setup?

my friend and I are trying to make the most anonymous setup for a computer to do things across the internet without being known the location from which it came. Our setup is as follows: A windows ...
TestinginProd's user avatar
12 votes
4 answers
5k views

Can someone use WiFi snooping to see data I send through Tor Browser when I'm not using SSL?

(NOTE: I've read other similar questions, but I'm not at all certain about this, therefore I'm asking.) I travel a lot, and I generally use public WiFi spots and hotels/hostels/boarding houses etc. ...
victor's user avatar
  • 121
12 votes
2 answers
2k views

How does Tor maintain anonymity when a source and destination are required at the end? [duplicate]

I had a question about Tor and the anonymity status of a fully decrypted packet that leaves a Tor exit node. My high-level understanding is that prior to a packet traversing the Tor network, a Tor ...
Derek Edwards's user avatar
11 votes
4 answers
13k views

What are the disadvantages of Tor?

I've just started using Tor recently, and I'm not sure exactly what security issues come with the benefits. What should/shouldn't I be worried about (in both everyday normal-web browsing use, in ...
root's user avatar
  • 1,537
11 votes
3 answers
62k views

Why disable JavaScript in Tor? [duplicate]

Why it is not advisable to use JavaScript with Tor? Yet with JavaScript, you cannot get the IP address of the user except through an external website. How could using JavaScript with Tor expose one's ...
spyker10's user avatar
  • 133
11 votes
3 answers
41k views

Difference between X-Forwarded-For IP, X-Real-IP, VPNs and TOR

I have this Google Chrome Privacy Preserving Extension that I am working on. Where I can spoof the header information e.g user agents and else. When I spoof X-Forwarded-For IP and go to http://...
Curtis Hagen's user avatar
11 votes
4 answers
40k views

Advanced techniques for detecting a proxy/getting original IP

In what manner can a website detect my original IP address, even though I'm using a proxy server? I've noticed this with a few sites. There are four proxy methods I've used: Firefox with a proxy ...
Claudiu's user avatar
  • 211
11 votes
1 answer
9k views

What are the implications of running a Tor non-exit relay node?

Intuitively, running a non-exit Tor node should bring the benefit of plausible deniability that a packet originated from your device. Unlike exit nodes however, you would not have to worry about ...
Arc's user avatar
  • 642
11 votes
1 answer
4k views

Meterpreter (Metasploit) anonymous reverse connection over Tor2web

The general consensus seems to be that one sets up a listener on a server accessible by a public IP and some port forwarding. For anonymity this should be a throw-away server or a hacked box. I've ...
Polarsbear's user avatar
10 votes
2 answers
17k views

Is chaining multiple VPNs a good way to reach anonymity on the internet?

I would like to chain a couple, say 6 or 7, VPNs together to create a sort of "super" encrypted lane on the internet. I'm not too concerned about speeds, all I want is privacy and anonymity. I've ...
Martijn's user avatar
  • 253

1
2 3 4 5
11